smolagents vulnerabilities
CVEs whose affected-version data names the smolagents package (pip). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
3 CVEsRSS
CVE-2026-4963Medium· 6.3Hugging Face Smolagents has an Injection issue
Hugging Face Smolagents has an Injection issue
▾ Sunlitsmolagents · smolagentsEPSS 0.59%via OSV
CVE-2026-2654Medium· 6.3Hugging Face Smolagents has a Server-Side Request Forgery issue
Hugging Face Smolagents has a Server-Side Request Forgery issue
▾ Sunlitsmolagents · smolagentsEPSS 0.43%via OSV
CVE-2025-11844Medium· 5.4PoCHugging Face Smolagents version 1.20.0 contains an XPath injection vulnerability in the search_item_ctrl_f function located in src/smolagents/vision_web_browser.py
Hugging Face Smolagents version 1.20.0 contains an XPath injection vulnerability in the search_item_ctrl_f function located in src/smolagents/vision_web_browser.py. The function constructs an XPath query by directly concatenating user-su…
▾ Twilighthuggingface · smolagentsEPSS 0.28%via NVD